Leaderless Revolution and the Easter Sri Lanka Attacks 26 June 2019

ISIS’
leaderless
revolution
& the Sri
Lanka
attacks
by
MeiLee Dozier & Jeff M. Moore, PhD
for the
Westminster Institute
26 June 2019
1
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

Agenda*
 Check the map
 Summary of attack
 Indications & warnings
 The culprits
 The bombs
 The church attacks
 The hotel attacks
 Three more bombs
 Aftermath
 Conclusions
*Situation out of the critical stage, but still developing. Investigations ongoing, data
points & subsequent analyses subject to change.
2
*OSINT (w/observed analyses on ground)

Check the map
3
Sainthamaruthu
Panadura
Kattankudy

Summary of the attack
Spectacular, highly synchronized, multi-stage, high-payoff; greater Colombo metro area & Batticaloa.
4
Phase 1: 21 Apr 2019 Phase 2: w/in 90 min Phase 3: 26 Apr 2019
 8 suicide bombers
 3 churches
 St. Anthony’s (1 IED)
 St. Sebastian’s (1
IED)
 Zion Church (1 IED;
initial targ)
 4 hotels (restaurants -1)
 Kingsbury (1 IED)
 Shangri-La (2 IEDs)
 Cinnamon Grand (1
IED)
 New Tropical Inn (1
IED; initial targ = Taj
Samudra, 2 IEDs?)
@ least 12 operatives @ least 14-16 IEDs @ 11 targs, 9 successful
Casualties: 258 KIA, 500 WIA NTJ-JMI/ISIS franchise
 3 follow on bombings
 1 VBIED (1-3
devices)
 1 roadside IED @
airport
 Lure bombing or
“come on”: raid on
key bomber’s house
by STF, wife kills self,
unborn child, 3
children, 3 police
 Terror cell’s last stand
 Ambush: firefight
w/STF, then 3
suicide bombs


 Buddhist-Muslim strife.
 3 Mar 2018, Kandy, Buddhist man beaten by Muslim youth after traffic dispute,
= 5 days of religious violence, 2 KIA, 20 mosques/224 houses/119 businesses
damaged or destroyed.
 26 Dec 2018, young men on motorcycles desecrated Buddha statues
around Mawanella.
5
Indicators & warnings
 2013 - 21 Apr 2019* (scores of issues/indicators/warnings before 2013).
1. Multiple Muslim-Buddhist strife (@ least 5 major instances).
2. Multiple IJ vs. Sufi/mod Muslim clashes (@ least 5 major instances, prior 2013).*
3. Moderate & Sufi Muslims informing on IJ directly to the SL gov (@ least 5 major
instances).
4. SL &/or foreign gov threat warnings/indicators (@ least 8 major instances).
1
 IJ vs. Sufi/moderate Muslims.
 10 Mar 2017 “Aliyar junction clash”, Hashim & followers met for debate w/Sufis,
showed up armed/primed for violence, Muslims shocked, angry @ Hashim.
 2006, multiple attacks on Sufi mosques.
2

6
Indicators & warnings
 Direct threat warnings on this very attack.
 4, 9, 11, and 21 April (day of).
 Incl lists of suspects.
 Incl churches as targets.
 Mar 2018, after Kandy riots Hashim released a video.
 Called for killing of non-Muslims in Sri Lanka.
 Police officers should be attacked.
 Bombs should be set off all over the country.
 Muslim leaders handed over the video to Sri Lankan police.
 Various occasion, Muslim Council of Sri Lanka.
 Warned gov of Hashim, provided CDs/propaganda material
 3 Jan 2019, All Ceylon Jamiaythul Ulema (ACJU – umbrella org of all Muslims,
criticize Sufis).
 Complained to MoD about the activities of NTJ.
 Provided list of suspects & activities.
3
4

 National Thowfeek Jamaath (Thawheed
Jama’ut, NTJ)
 “National ‘One Religion/One God’ Organization.”
 Origins in S Indian state Tamil Nadu, early 2000s.
 Protested “social evils”, rumored $ from ME.
 Hashim founded NTJ in SL in 2012 (est).
 Hashim “kicked out of NTJ” in 2017 (possibly
D&D to protect JMT post bombing).
 Jammiyathul Millathu Ibrahim (JMI)
 “Organization of the Way of Abraham.”
 Seemed to have joined w/NTJ.
 Leadership
 Mohammed Cassim Mohamed
Zaharan (Hashim).
 Born ‘86, radical as a teen.
 Sister: “…He started to preach against
the government, the national flag,
against elections, & against other
religions. He brought catastrophe
upon our family.”
 Assembled like minded group,
convinced Sufis to convert to IJ.
 Conspired to live up to his preaching.
The culprits
7

“…the savagery, brutality & ill
intentions of the Christians
towards the Muslim
community.”
 ISIS
 Leaderless revolution strategy: co-opting individuals
& groups electronically & dahwah.
 Train, plan, execute operations on their own.
 29 April, Abu Bakr al-Baghdadi video, 1st
time in 5
yrs, Sri Lanka was ISIS op for losing caliphate.
 Al-Baghdadi’s vid featured Easter bombers’ video
pledging to ISIS.
The culprits
“…Our battle today is one of attrition,” &
“God ordered us to wage jihad & did not
order us to achieve victory.”
“…The only effective method against those
tawaghit (taghut) is al-sayf. They need to
return to the Almighty & Exalted God.”
“This, by God’s permission, is only part of the
vengeance that is awaiting the crusaders &
their quislings. All praise is due to God, for
among those killed were some Americans &
Europeans.”
“As for you brothers in Sri Lanka, they have pleased &
healed the muwahideen’s chests with their inghimasi
operations that unsettled the crusaders in their Easter
celebration to avenge their brothers in Baghuz.”
1
2
3
4
8
5

 @ least 1 yr testing: bomb factories,
timing devices, tested on motorcycles.
 Manufactured by local IJ “w/ISIS
expertise” – possibly done w/out ISIS
 Container = gray backpack, 30-40
liters.
 Explosive compound = TATP + possibly
watergel, or gelignite, or ANFO.
 Shrapnel: nails & ball bearings.
 Trigger/switch = pull strap on
backpack.
 Detonator/initiator = lightbulb
filament.
The bombs
NTJ weapons cache, 182 sticks of watergel (est)
9
triacetone triperoxide

St Sebastian’s
The bombs
St Anthony’s
Zion Church
10

The bombs
The Kingsbury
The Shangri-La
The Cinnamon Grand
11

The church attacks
12
 St. Anthony’s Shrine, Colombo
 Famous historic church, attended
by VIPs, politicians, commemorated
on stamp
 Detonated 8:45 am.
 Exploded at rear of packed church,
congregation absorbed blast, front of
congregation = fewer casualties.
 @ least 54 KIA.
 St. Sebastian’s Church, Negombo
 Bomber walked across
courtyard into middle of church
unhindered, stopped to gingerly
touch a little girl.
 Exploded at middle entrance on left
side of congregation.
 105 KIA.

13
The church attacks
 Zion Church Batticaloa
 Bomber was suspected of casing the
site the day before.
 8:30 am (21 Apr) inquires about mass
at St. Mary’s Cathedral, missed
service, which was held earlier
than usual & was refused entry.
 CCTV shows him returning to mosque
after seemingly casing another venue,
Zion Church 400m away.
 9:30 am leaves Jami us
Salam Jumma Masjid, walks to Zion
Church, refused entry into main hall.
 9:38-9:45 am detonates in church
courtyard.
 26 KIA, 100 WIA.

 The Kingsbury Hotel
 Checked in w/bomb at 7:30 pm.
 Got in line, Harbour Court’s
breakfast buffet.
 Detonated 8:47am.
 Casualties UNK, @ least 8 KIA.
 Damage ($361,037.50 USD worth).
 Hotel remained open.
 The Shangri La
 Checked in w/bombs, used real name…
 …possibly a lure tactic – raid on house.
 2 bombers in lift, joking w/each other.
 Entered the Table One’s breakfast buffet,
reportedly from different sides.
 33 KIA.
 Reopened 12 Jun (ahead of 19 Jun schedule).
The hotel attacks
14

 New Tropical Inn
 Original targ, Taj Samudra’s Ports of Call
breakfast buffet.
 Checked in 4:53 pm, w/roller luggage.
 Left, returned 7:07 am 21 April w/+ roller
luggage.
 8:50 am, Ports of Call, failed detonation.
 Left Taj, checked into New Tropical Inn, 9:30
am.
 Left 9:45 am, returned, & detonated 1:30 pm.
 2 KIA.
 Nearly leveled building.
 Cinnamon Grand
 Checked in using fake name.
 Entered Taprobane’s breakfast
buffet.
 Appeared unsure, stepped back &
forth, hesitated.
 20 KIA.
 Hotel remained open.
The hotel attacks
15

 21 April 2019, Raid on bomber’s condo
 Wife met police @ the door.
 Ran to top of the stairs, detonated suicide bomb.
 Killed self, unborn child, 3 children, 3 police.
 Rilwan, on video, said the wives would detonate & meet
their husbands in heaven.
 21 April 2019, pipe bomb, airport access road
 Air Force patrol discovered 6-ft pipe bomb, EOD secured.
 50 kgs (110 lbs) of explosives.
 400-meter (437-yard) blast radius.
 22 April 2019, vehicle bomb
 Outside St. Anthony’s shrine, failed to explode.
 Timed to detonate (washing machine timer) 90 min later.
 Targeted 1st
responders.
 Exploded as EOD tried to defuse it.
Three more bombs
16

 Nationwide emergency, curfew, increased
security, arrest powers widened.
 Social media restricted.
 Ban on burka/all Muslim face veils.
 Weeks of raids/search ops.
 Over 500 arrested: 102 in police-TID custody
for links to the attack.
 Scores of weapons caches discovered (not
all IJ).
 Gov scandal, scores of resignations:
 Police chief, defense minister, intelligence
chief.
 9+ Muslim ministers.
Aftermath
17
 FBI, India’s NIA, others assist.
 Saudi deported 5 SL citizens linked to
attacks.
 …incl Mohammad Milhan: NTJ
 Connected to 2018 execution of 2 police.
 Deportations.
 600 w/links to IJ.
 …incl 200 clerics…
 …expired visas, India, Pakistan,
Bangladesh, Maldives.
 Religious violence – Buddhists vs
Muslims.
 …in places like the NW province,
hundreds of Muslims left homeless.

Aftermath
 Terror camp discovered (2d one)
 4 May 2019, Kattankudy, run by NTJ.
 10-15-acres.
 Owned by Mohammed Milhan.
 Cover was chicken farm.
 100 + militants trained there from India,
Pakistan, & SL.
 Pipe bomb materials found.
 Evidence of firearms training.
 Bomb factory & Hashim’s family’s final stand
 26 April 2019, 7:30 pm, in Sainthamaruthu.
 Intel from police & Muslims.
 Bomb factory, planning HQ.
 Firefight w/STF, 3 suicide bombs, killed 9 fam members,
incl 6 children.
 Hashim’s father, Mohamed Hashim.
 2 brothers, Zainee & Rilwan.
 1 civ KIA & 2 WIA (Hashim’s wife/daughter).
 16 KIA.
 150 sticks of explosives, drone, ISIS flag. Zainee, younger brother of Hashim, video: (holding an AK-47
w/child), “The killings won’t stop here, even if we are destroyed...you
can be sure you will meet more of these attacks in future.”
18

Conclusions
19
 Overall Analysis
 ISIS’ 1st
major post-caliphate op.
 Sophisticated, multi-stage bombings.
 Highly successful, both tactically &
strategically.
 258 KIA, 500 WIA, 758 total, shock/horror,
tourism-gov impacted (47 foreigners IKIA).
 ISIS = force to be reckoned with.
 Leaderless revolution works.
 Tactical-operational analysis
 Personnel = dedicated, true believers,
methodical, relentless.
 Intelligence = excellent.
 Operational expertise = professional.
 Logistics = highly resourceful.
 High organizational prowess, well-
coordinated.
 Excellent synchronization (@ least
12 operatives, 11 targs, 9 good
hits, & 2 good lure/follow-ons).
 Studied/understood flow of
LE/security op cycle; attacked it.
 Demonstrated denial & deception.
Tourism = 4.9 % of Sri Lanka’s GDP,
$4.4 bn, dropped 70%.

Conclusions
20
 Indicators & warnings
 Intelligence failures.
 PC hysteria & gov infighting blinded gov, =
people killed.
 Hotel security = negligence; had access to
critical data points clearly indicated viable
threats.
 Target selection
 Softest targets possible – churches & hotels.
 IJ/ISIS/AQ priority targs.
 “Targets w/in targets” = Sunday buffet lines
& Easter congregations.
 1) IJ vs. Buddhist strife.
 2) A major IJ terror camp found
with over 200 lbs of explosives,
plus detonators.
 3) Issues 1-2 = SOP for IJ war
escalation, totality of
circumstances = should have
increased security.
 Failure to heed.
 Failure to disseminate.

Conclusions
21
 Assessment
 ISIS will act on its words, per usual.
 Seeds of religious war sewn in SL.
 SL operational model = replicate
when/where possible.
 Leaderless revolution will continue.
 Distributed ops will increase (at least, that is
the intention).
 Strikes against non-traditional targs & across
dispersed “ISIS provinces.”
 Govs cannot combat ISIS alone –
corporations must increase intel & phys
security.
 Tourism/hotels increasingly at risk.
 Churches/Christianity, other religions,
Muslim minorities increasingly at risk.
 War for the sake of war. (end
goal of “victory” not necessary)
 Attrition. (high casualty counts)
 Revenge. (new, angry motivation)
 Tawaghits/taghut. (govs ruled by
man’s law, particularly
democracies, which are haram)
 Americans & EU citizens. (always
targets in the past, now they are
doubling down)
 More to come. (official IJ warning
has been issued)

Question
s?
22

Video
Read the transcript
. Watch thevideo .

Leaderless Revolution and the Easter Sri Lanka Attacks 26 June 2019

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (20)

Featured

Featured (20)

Leaderless Revolution and the Easter Sri Lanka Attacks 26 June 2019

Editor's Notes